Recently we had a web server running Apache (2.2.3) compromised and are in the process of cleaning data and moving to another server to that we can rebuild the current one.
We want to try and figure out what was done after we've finished moving to a new server. We've got the easy stuff, the injected PHP code in numerous files and PHP inserted into the database.
At the same time we still have tags with-in the of html documents changed or a big blob of text inserted right after the opening tag in document. This happens on all HTML files sent to search engines be it from a static HTML file or generated from a PHP file. It will also redirect anyone coming from search engines to another site as long as their referer contains certain keywords.
If the page is cached in our reverse proxy this no longer happens, which has helped us narrow it down to something potentially in Apache. This is where I wonder "Where do I look?" we've looked for extra modules added in and checked in our config files and have yet to find anything that sticks out.
Where might be some other places to check so we can see what exactly is going on?